Can you set a longer throttle_period?
I see it set to 30 minutes in your example, maybe a bigger value would be enough.
I think it's the most suitable mechanism for handling duplicate notifications.
Maybe we can suggest to the elastic devs to implement some kind of "forever" value for that parameter ![]()
If that were not possible, what comes to my mind would be much more cumbersome:
- Add another search (so chain inputs) to obtain the results of the last execution (e.g. sort a small time range) recorded in the .watcher-history-... index each time the watcher is triggered.
- Add comparison logic (so probably a script comparison) to take that values into account.
You can find related information in this question: